CVE-2026-42572: falha de média gravidade em hatchet-dev hatchet
Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
hatchet-dev · hatchetCVEs relacionadas — hatchet-dev hatchet
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54746MEDIUMHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeEPSS 0.4%CVE-2026-108755MEDIUMHatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion EndpointEPSS 0.3%CVE-2026-63342MEDIUMHatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization CheckEPSS 0.3%CVE-2026-61681MEDIUMHatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation HandlerEPSS 0.3%CVE-2026-88978MEDIUMHatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterEPSS 0.3%CVE-2026-84298LOWHatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherEPSS 0.2%